dotnet / dotnet/vscode-dotnet-runtime
Uninstall runtimes/SDK that are out of support or vulnerable.
- Dominant language
- TypeScript
- Stars
- 209
- Forks
- 455
- PR merge metrics
- No merged PRs in 30d
Description
### Is your feature request related to a problem? Please describe.
Without any kind of change, this extension will install many copies of the .NET Runtime as various extensions request them. In addition, leaving older runtimes around on the system can present a security risk as newer versions of the runtime come with security fixes.
### A clear and concise description of what you want to happen. Include any alternative solutions you've considered.
For SDKs and Runtimes that this extension manages that are out-of-support or have CVEs and have an in-support version already installed, this extension should clean up those older versions.
### Describe the solution you'd like
We should clean up releases that have CVEs listed (see the cve-list property on the [releases manifest](https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/9.0/releases.json)) on a periodic basis. If extensions do need out of support runtimes they should re-request on launch.
Specifically, once per launch of this extension we should check the releases manifest, and if the latest requested runtime is a security release then we need to clean up all previous versions of the requested runtime.
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.